TROJ_BANLOAD

March 07, 2015
 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Dropped by other malware, Downloaded from the Internet

BANLOAD malware variants arrive on the systems as files dropped by other malware or as files downloaded unknowingly by users when visiting malicious sites. When executed, these connect to malicious URLs to download other malware on already infected systems which leads to further infection. BANLOAD variants are known to download BANKER malware variants.

In 2010, cybercriminals took advantage of the Haiti earthquake as a spam lure. The spammed messages written in Portuguses tricked users into clicking a link that supposedly contains photos of the earthquake. This led to a malicious website that downloads TROJ_BANLOAD.JAE.

Cybercriminals also copied the site of Ministerio do Trabalho e Emprego, or the Ministry of Labor and Employment in Brazil to spread TROJ_BANLOAD.JMO. When executed, it gathers email addresses and downloads BANKER variants.

  TECHNICAL DETAILS

File Size:

Varies

File Type:

PE, EXE

Memory Resident:

Yes

Initial Samples Received Date:

13 Sep 2007

Payload:

Downloads files

Installation

This Trojan drops the following copies of itself into the affected system:

  • %System%\aqlb.hjo
  • %Windows%\system\{malware file name}.exe
  • %System%\incognito.exe
  • %Program Files%\Common Files\Files.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.)

It drops the following files:

  • %Windows%\Envia.txt
  • %User Profile%\fxconfig.bat
  • %Current%\{malware name}-up.txt
  • %Program Files%\Common Files\Microsoft Shared\Web Folders\MSONSEXT409.dll

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{random string} = "{malware path and file name}.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\ {ADEEAF15-7FE8-DEDD-3FFF-4DF56EBB1DFB}
StubPath = "{malware path and file name}.exe"

It modifies the following registry entry(ies) to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = "Explorer.exe rundll32.exe {malware file name) lhoweid"

(Note: The default value data of the said registry entry is Explorer.exe.)

Other Details

This Trojan connects to the following possibly malicious URL:

  • http://www.{BLOCKED}nvirtual.com/index.php
  • http://www.{BLOCKED}a.net/image/top_02.gif
  • http://{BLOCKED}.{BLOCKED}.0.28/img/imag1.gif
  • http://{BLOCKED}x.mogsoft.de/gallery2dir/themes/ice/compactone.exe
  • http://{BLOCKED}x.mogsoft.de/gallery2dir/themes/ice/compress.exe
  • http://{BLOCKED}ana-walker.com/site/msdos.exe
  • http://www.{BLOCKED}rg.br/v2/env/msdos.exe
  • http://www.{BLOCKED}kanan.net//espace_pro/msdos.exe
  • http://www.{BLOCKED}eton.ru/por/setup64.exe
  • http://{BLOCKED}chomes.in/images/images.rar
  • http://{BLOCKED}olhado.com.br/js/images.rar
  • http://{BLOCKED}l-levata.com/js/images.rar
  • http://{BLOCKED}.com/js/images.rar
  • http://{BLOCKED}x-arq.com/js/images.rar
  • http://{BLOCKED}igoseamigos2010.kit.net/images.rar
  • http://{BLOCKED}lacionandoamigos.kit.net/images.rar
  • http://{BLOCKED}lpemacla.kit.net/images.rar
  • http://{BLOCKED}nanet2006.kit.net/images.rar
  • http://{BLOCKED}usamonteloavalanche.kit.net/images.rar
  • http://{BLOCKED}igossysters.kit.net/images.rar
  • http://{BLOCKED}perbonus.kit.net/images.rar
  • http://{BLOCKED}amigos2010.kit.net/images.r